https://community.splunk.com/t5/Getting-Data-In/How-to-extract-json-from-event-with-separated-values/m-p/617425#M106603 <P>&nbsp;</P> <P>Hello, I have the following type of event, and I would like to extract the `tags` field into its respective fields.&nbsp;</P> <P>&nbsp;</P> <LI-CODE lang="markup">2022-10-17 06:50:00.997, root_device_name="/dev/sda1", root_device_type="ebs", state_name="running", subnet_id="subnet-REDACTED", tags="{"App": "myapp", "Name": "myserver", "Owner": "myteam", "Scope": "myscope", "AWSBackup": "True", "Environment": "myenv", "Compliance requirement": "N/A"}", virtualization_type="hvm", vpc_id="vpc-REDACTED"</LI-CODE> <P>&nbsp;</P> <P><SPAN class=""><BR /><BR />I have tried the following which did not work for me:&nbsp;<BR /></SPAN></P> <P>&nbsp;</P> <LI-CODE lang="markup">index=myindex sourcetype=mysourcetype earliest=@d i-REDACTED source=awsec2instances | spath input=tags </LI-CODE> <P>&nbsp;</P> <P><SPAN class="">How do I extract these JSON fields from an event like this?&nbsp;</SPAN></P> Mon, 17 Oct 2022 21:35:52 GMT zachsisinst 2022-10-17T21:35:52Z https://community.splunk.com/t5/Getting-Data-In/How-to-extract-json-from-event-with-separated-values/m-p/617425#M106603 <P>&nbsp;</P> <P>Hello, I have the following type of event, and I would like to extract the `tags` field into its respective fields.&nbsp;</P> <P>&nbsp;</P> <LI-CODE lang="markup">2022-10-17 06:50:00.997, root_device_name="/dev/sda1", root_device_type="ebs", state_name="running", subnet_id="subnet-REDACTED", tags="{"App": "myapp", "Name": "myserver", "Owner": "myteam", "Scope": "myscope", "AWSBackup": "True", "Environment": "myenv", "Compliance requirement": "N/A"}", virtualization_type="hvm", vpc_id="vpc-REDACTED"</LI-CODE> <P>&nbsp;</P> <P><SPAN class=""><BR /><BR />I have tried the following which did not work for me:&nbsp;<BR /></SPAN></P> <P>&nbsp;</P> <LI-CODE lang="markup">index=myindex sourcetype=mysourcetype earliest=@d i-REDACTED source=awsec2instances | spath input=tags </LI-CODE> <P>&nbsp;</P> <P><SPAN class="">How do I extract these JSON fields from an event like this?&nbsp;</SPAN></P> Mon, 17 Oct 2022 21:35:52 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-extract-json-from-event-with-separated-values/m-p/617425#M106603 zachsisinst 2022-10-17T21:35:52Z https://community.splunk.com/t5/Getting-Data-In/How-to-extract-json-from-event-with-separated-values/m-p/617435#M106605 <P>Try something like this</P><LI-CODE lang="markup">| rex "tags=\"(?&lt;tags&gt;\{[^\}]+\})" | spath input=tags</LI-CODE> Mon, 17 Oct 2022 22:04:12 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-extract-json-from-event-with-separated-values/m-p/617435#M106605 ITWhisperer 2022-10-17T22:04:12Z